CVE-2023-6163: WP Crowdfunding < 2.1.10 - Admin+ Stored XSS
The WP Crowdfunding WordPress plugin before 2.1.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6163?
CVE-2023-6163 is considered a high severity vulnerability due to its potential for Stored Cross-Site Scripting attacks by high privilege users.
How do I fix CVE-2023-6163?
To fix CVE-2023-6163, update the WP Crowdfunding plugin to version 2.1.10 or later.
Who is affected by CVE-2023-6163?
Users of the WP Crowdfunding WordPress plugin before version 2.1.10 are affected by CVE-2023-6163.
What type of attack does CVE-2023-6163 allow?
CVE-2023-6163 allows high privilege users to perform Stored Cross-Site Scripting attacks.
Can CVE-2023-6163 be exploited in a multisite environment?
Yes, CVE-2023-6163 can be exploited in a multisite environment even when the unfiltered_html capability is disallowed.